🔤
Homoglyph Attacks (Lookalike Domains)
High SeverityHomoglyph domains increased 400% between 2021-2023
Homoglyph attacks exploit characters that look visually identical or very similar across different alphabets. Attackers register domains like "pаypal.com" (Cyrillic "а") that appear identical to "paypal.com" (Latin "a").
How it works
- Attacker identifies target brand domain (e.g., paypal.com)
- Registers a domain substituting look-alike Unicode characters
- Common swaps: Cyrillic а/о/е for Latin a/o/e, digit 1 for lowercase l
- Sends emails from the visually-identical domain that pass basic checks
Red flags to watch for
- Email from a "known" sender but something feels off
- Copy-paste the domain and compare it — homoglyphs break when pasted into a text editor
- Unexpected requests from normally trusted senders
Real-world example
Subject: Your PayPal receipt for $499.99
From: service@pаypal.com
“You sent a payment of $499.99 to Electronics Depot. If you didn't authorize this transaction, click here to dispute it immediately.”
How to protect yourself
- Use SiftMail Business tier with homoglyph detection enabled
- Be suspicious of any email requesting action, even from "known" senders
- Copy-paste sender addresses into a plain text editor to reveal character substitutions
How SiftMail detects this
SiftMail Business tier includes dedicated homoglyph detection that identifies Unicode character substitutions, Levenshtein-distance domain similarity, and flags impersonation attempts automatically.
Spot homoglyph attacks (lookalike domains) the moment they land
SiftMail scores every email after delivery and labels the risky ones. Preview what it found, confirm, and archive in one pass. Free plan available, setup takes 30 seconds.